VNVietnamconfidence: 50G0050
APT32APT32
Also known as: OceanLotus Group · Ocean Lotus · OceanLotus · Cobalt Kitty · APT-C-00 · SeaLotus · Sea Lotus · APT-32 · APT 32 · Ocean Buffalo · POND LOACH · TIN WOODLAWN · BISMUTH · ATK17 · G0050 · Canvas Cyclone · APT32
Origin
VN
Known aliases
17
Target sectors
3
Attribution
State-sponsored
Profile
Cyber espionage actors, now designated by FireEye as APT32 (OceanLotus Group), are carrying out intrusions into private sector companies across multiple industries and have also targeted foreign governments, dissidents, and journalists. FireEye assesses that APT32 leverages a unique suite of fully-featured malware, in conjunction with commercially-available tools, to conduct targeted operations that are aligned with Vietnamese state interests.
Aliases· 17
OceanLotus GroupOcean LotusOceanLotusCobalt KittyAPT-C-00SeaLotusSea LotusAPT-32APT 32Ocean BuffaloPOND LOACHTIN WOODLAWNBISMUTHATK17Canvas CycloneAPT32
Target sectors· 3
GovernmentPrivate sectorCivil society
Known victims· 6
- China
- Germany
- United States
- Vietnam
- Philippines
- Association of Southeast Asian Nations
MITRE ATT&CK Group crosswalk
References
- https://attack.mitre.org/groups/G0050/
- https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html
- https://www.cybereason.com/labs-operation-cobalt-kitty-a-large-scale-apt-in-asia-carried-out-by-the-oceanlotus-group/
- https://www.scmagazineuk.com/ocean-lotus-groupapt-32-identified-as-vietnamese-apt-group/article/663565/
- https://www.brighttalk.com/webcast/10703/261205
- https://github.com/eset/malware-research/tree/master/oceanlotus
- https://www.cfr.org/interactive/cyber-operations/ocean-lotus
- https://www.accenture.com/us-en/blogs/blogs-pond-loach-delivers-badcake-malware
Related by meaning· 6
Nearest entities by semantic similarity across the cs-graph corpus.